Mobile devices capable of transmitting voice and data are becoming common in the market place and are sometimes referred to as Smartphones or personal digital assistants (PDAs). Examples include the Research in Motion Blackberry™, Palm Treo™, among others. The capability of transmitting voice over a data connection is called Voice Over Internet Protocol (VoIP) and allows such devices to carry voice traffic over an internet connection, bypassing the traditional circuit switched voice services offered over wide-area wireless networks.
VoIP capability is of great value to enterprises for keeping costs of telephony services low. An example includes a large employer whose factory spans hundreds of acres. The employer can blanket that area with a wireless local area network (WLAN) such as 802.11 (Wireless Fidelity “WiFi”) technology and equip its employees with WiFi enabled handsets for VoIP calls over WiFi, thus bypassing the carrier operated wide-area wireless service.
Publicly available applications exist that can be loaded onto a handheld mobile device that offer telephony and multimedia services. Examples include Skype™, MSN™, Yahoo™, and GoogleTalk™. These applications can bypass any corporate control of how the handheld mobile device is used for voice and may potentially be a security risk for the enterprise. Skype™, for example, is peer-to-peer protocol that can pass through corporate firewalls and potentially circumvent corporate IT security measures by using the file transfer feature of Skype™ to transfer corporate proprietary material outside the enterprise.
Peer-to-peer resources sharing protocols such as Skype™ have other characteristics that raise security concerns or may impact corporate policy on use of corporate computing resources for non-corporate purposes. These problems are common to most general purpose telephony applications. While these applications can pose a risk to the corporation, the benefit of low cost telephony service is very attractive and the corporation may accept such risks and depend on the trust it places on its employees to justify the risk. Similar issues exist for multimedia applications.
A further benefit is that when a corporation supplies a handheld device to its employees and allows the employees to use it out of hours and for personal purposes, as long as the use is within reasonable limits, the handheld becomes a significant fringe benefit or a perk for the employee. Thus limiting the use of the handheld only to within the confines of the corporation head office or campus and only for business purposes or only during working hours is seen today as somewhat draconian. A preferable solution would be to ensure that while the employee is connected to the corporation (either by direct connection from within the physical office site or through a virtual private network “VPN” connection) he or she is unable to use any application that may impact the security of the organization. Outside of the corporation and outside of business hours, the handheld may be used for personal and/or work purposes trusting the employee does not misuse the privilege.